Snapshot Metadata Ransomware Detection With Cloud ML Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware detection is challenging due to the prevalence of signature-based approaches that are ineffective against variant malware, and existing machine learning-based solutions are computationally expensive, particularly in production environments.
Innovation Solution
A hybrid-cloud architecture leveraging snapshot metadata for anomaly and ransomware detection, offloading computational tasks to a cloud-based SaaS platform, and using machine-learning models trained on filesystem metadata to minimize overhead on primary machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning-based behavioral analysis is used to detect ransomware, then detection precision is improved, but computational cost increases significantly
Solution Approach 1:
The patent extracts only the essential metadata features from filesystem snapshots that are most indicative of ransomware behavior, rather than performing comprehensive analysis of all files and operations. This selective extraction of critical features maintains detection precision while dramatically reducing computational overhead.
Solution Approach 2:
The detection system is segmented into multiple components: snapshot collection, metadata extraction, feature selection, and machine learning classification. This segmentation allows computational tasks to be distributed and optimized, with lightweight operations running on production systems and heavier ML inference performed separately, reducing overall computational burden.
2Measurement precision
If comprehensive machine learning analysis is performed on production systems, then detection accuracy is improved, but system performance deteriorates
Solution Approach 1:
The system creates snapshots (copies) of the filesystem state at different points in time, allowing ML analysis to be performed on these copies rather than the live production system. This enables comprehensive analysis without impacting production performance, as the snapshots are analytical replicas that can be processed independently.
Solution Approach 2:
Filesystem snapshots and metadata are collected and prepared in advance before ML analysis is performed. This preliminary action separates data collection from analysis, allowing the production system to continue normal operations while backup systems prepare the data, and ML models process the pre-collected metadata without causing performance degradation.
3Use of energy by moving object
If signature-based approaches are used for malware detection, then computational overhead is reduced, but detection reliability decreases against variant malware
Solution Approach 1:
The system transitions from detecting static signatures (fixed parameters) to analyzing dynamic behavioral parameters such as file creation rates, modification patterns, and metadata changes. By monitoring how parameters change over time rather than matching fixed signatures, the system achieves both low computational overhead and high reliability against malware variants.
Data Source
AI summary
Some examples relate generally to computer architecture software for information security and, in some more particular aspects, to machine learning based on changes in snapshot metadata for anomaly and ransomware detection in a file system.